🧠 Food for thought

Implications, context, and why it matters.

Crypto exam shift may signal reclassification

• FY2026 priorities lack a standalone crypto section. Oversight likely sits within custody (safeguarding client assets) and fiduciary duty (acting in clients’ best interests). It may also sit within standards of conduct or data privacy.
• In 2025, exam priorities covered crypto assets 1. They named conduct standards and risk disclosures. They also covered operational resilience and security of blockchain-based assets.
• SEC often weaves new risks into existing exams. Crypto reviews may now sit inside custody and conduct work as part of routine exams.

New data privacy rules create openings for compliance tech vendors

• SEC is prioritizing new customer data privacy rules. Regulation S-P amendments require compliance by December 3, 2025, for larger broker-dealers (firms that trade securities for clients) and investment advisers (registered firms that manage client portfolios) 2. Vendors that offer incident response, breach notification, and customer data protection can pitch now.
• The amendments require written incident response programs and a 30-day customer notification timeline for breaches. Service providers must alert covered institutions within 72 hours of detecting a breach 3. These rules create concrete technical needs that regtech (regulatory technology) and cybersecurity vendors can meet with purpose-built tools.
• Investment advisers with $1.5 billion or more in Assets Under Management (AUM) and larger broker-dealers face the December 2025 deadline 4. Vendors should target firms that still need notification workflows and recordkeeping upgrades.